awesome-threat-modeling

Threat modeling resources

A curated list of resources for threat modeling and risk management in software development

a curated list of useful threat modeling resources

GitHub

125 stars
8 watching
15 forks
last commit: about 2 years ago
Linked from 1 awesome list

risk-assessmentsecuritythreat-modeling

Table of Contents / General

OWASP page on Application Threat Modeling
OpenSAMM Threat Assessment
Microsoft threat modeling posts

Table of Contents / Data Flow Diagrams

Presentation (PDF) with very good introduction to DFDs
DFD Example and explanation
graphviz
draw.io
TikZ

Table of Contents / Threat Enumeration

STRIDE (Spoofing, Tampering, Repudiation, Information disclosure, Denial of Service, Elevation of Privilege)
Attack Trees

Table of Contents / Prioritization Methodologies

DREAD (Damage, Reproducibility, Exploitability, Affected users, Discoverability)

Table of Contents / Conference Talks

Rapid Threat ModelingAkshay Aggarwal - Blackhat USA (2005)
Part 1Elevation of Privilege: The easy way to threat model and - Adam Shostack - Blackhat (2010)
Threat Modeling Best PracticesRobert Zigweid - AppSecUSA (2010)
Threat Modeling: Lessons from Star WarsAdam Shostack - Brucon (2014)
Incremental Threat ModelingIrene Michlin - AppSecEU (2017)
Threat Modeling with PASTATony UcedaVelez - AppSecEU (2017)
Value Driven Threat ModelingAvi Douglen - AppSecUSA (2018)
Threat Modeling ToolkitJonathan Marcil - AppSecCali (2018)
Lessons From The Threat Modeling TrenchesBrook Schoenfield - AppSecCali (2018)
Threat Model as CodeAbhay Bhargav - AppSecUSA (2018)
Threat Modeling at speed and scaleStuart Winter-Tear - DevSecCon London (2018)
Threat Modeling: uncover vulnerabilities without looking at codeChris Romeo - NDC (2018)
Threat Modeling in 2018Adam Shostack - Blackhat USA (2018)
Threat Modeling in 2019Adam Shostack - RSA Conference (2019)
Offensive Threat Models Against the Supply ChainTony UcedaVelez - AppSecCali (2019)
Threat Model Every Story: Practical Continuous Threat Modeling Work for Your TeamIzar Tarandach - AppSecCali (2019)
Game On! Adding Privacy to Threat ModelingAdam Shostack, Mark Vinkovits - AppSecCali (2019)
Adaptive Threat ModelingAaron Bedra - GOTO Chicago (2017)

Table of Contents / Books

Threat Modeling: Designing for SecurityShostack,
Guide to Data-Centric System Threat ModelingNIST,

Table of Contents / Tools

Microsoft TMT
OWASP Threat Dragon
Mozilla Seasponge278over 8 years ago
IriusRisk
eramba
Elevation of Privilege (EoP) Threat Modeling Card Game
Threat Playbook
pytm934almost 2 years ago
ThreatSpec
Threat Model SDK79over 3 years ago
TaaC-AI118over 2 years ago

Backlinks from these awesome lists:

0